There is a permission as to who can view member lists which would prevent users from seeing the list of online members, so that may be useful.
Also in the template forum_list, to hide the stats from all but admins you can find this: